Some or all of your users fail to display in the main Users container in the RM Unify AD Sync Config Tool. In addition to this, the AD Sync log files contains the following error:

"ERROR,"ProcessADUser","Failed to process changes for AD User <ADUser> (<GUID>) - System.Runtime.InteropServices.COMException (0x8007200A): The specified directory service attribute or value does not exist."
where <ADUser> is a missing user and <GUID> is a unique GUID.

The identitysyncservice user needs read permission on containers in Active Directory in order to search for users, e.g. CN=Users. If this permission is missing then the error will display.

By default, the identitysyncservice user is granted group membership of account operators and domain users during installation of RM Unify AD Sync. This group membership is sufficient to grant the user read permission on AD containers, unless customised permissions have been set on one or more containers.

1. On the AD Sync server, open the AD Sync Config Tool.
2. Click Services, Stop.
3. On a domain controller, signed in as an administrator, open 'Active Directory Users and Computers' and browse to the Users OU.
4. Right-click the identitysyncservice user account and click Properties, 'Member Of tab', and then Add.
5. Type administrators and click OK, OK.
6. On the AD Sync server, open the AD Sync Config Tool.
7. Click Services, Start.
8. Wait 20 minutes and check if the AD Sync log file contains the same error. If the error no longer appears in the log file and missing users have started to appear in the AD Sync Config Tool then there is an issue with permissions.
9. Repeat steps 1 to 7, remove the identitysyncservice user from the administrator's group and continue with troubleshooting.

1. Log on to a domain controller as an administrator and open 'Active Directory Users and Computers'.
2. Click View, Advanced Features and navigate down to the Users container.
3. Right-click and select Properties.
4. Click Security, Advanced.
5. Click the Effective Access tab and then click 'Select a user'.
6. Type identitysyncservice and click OK.
7. Click 'View effective access'.
8. Confirm the user has been granted (i.e. there is a green tick) next to the following permissions:
   • 'List contents'
   • 'Read all properties'
   • 'Read permissions'
9. Repeat steps 2 to 7 for all other containers.

If you followed the above and found you needed to correct some permissions then complete the following:

1. On the AD Sync server, open the AD Sync Config Tool.
2. Click Service, Stop.
3. Click Server, Start.
4. Wait 20 minutes and check if the missing users are now visible in the Users container in the AD Sync Config Tool.